Sometimes, you do the best you can, but things happen anyway.

You follow all the best practices, all your systems are locked down, you spend twice as much as your peers on cybersecurity, you have cyber insurance in place, and a hacker still gets through. You get sued, there's a judgment against your company that's more than the maximum payout on your cyber insurance policy, and you're out of business. Your company is paying the price for something completely out of its control.